Slaloma: Privacy and terms

Privacy policy · Last updated 27 October 2026

1. Who we are

Slaloma is an iPhone app (with widgets and a Live Activity) and the online service behind it, at slaloma.app. It shows readings from your continuous glucose monitor (CGM), keeps a diary of what you log, sends alerts, and answers questions about your own data.

Slaloma is published by its developer as an individual; there is no company behind it. The developer decides how your personal data is used (the "controller"; "we" and "us" in this policy).

• Contact for privacy questions and requests: hello@slaloma.app
• We have not appointed a data protection officer.

2. What we collect and why

We collect only what the service needs to work. We do not sell your data and we do not use it for advertising.

• Account and sign-in: your email address and how you sign in (Google, Sign in with Apple, or an emailed sign-in link and code). With Sign in with Apple we get Apple's account ID, and Apple's relay address if you hide your email. Session records. Used to create your account, sign you in and contact you about it. Kept until you delete your account; sessions until they expire.
• Consent records: which version of the in-app terms you agreed to, when, and a fingerprint (SHA-256) of the exact text you were shown. Used to prove what you agreed to. Kept until you delete your account.
• CGM readings: glucose values and trend, read from Dexcom Share or LibreLinkUp about every 5 minutes (for an account already set up that way, read from a Nightscout site or sent by an uploader app, xDrip+ or Juggluco); older history you import from a LibreView file. Used to show your readings, charts and statistics, and to send your alerts. Kept until you delete your account (minute-by-minute copies are thinned after 3 days once the 5-minute history covers them).
• CGM sign-in: for Libre, a LibreLinkUp follower account's email and password; for Dexcom, your Dexcom username and password; for an account already set up with a Nightscout site, the site's address and its token or API secret, or with an uploader app, the secret we made for it. Encrypted (see Security). Used only to fetch your readings for you. Kept until you remove it or delete your account.
• What you log: meals, carbohydrates, insulin, low treatments, exercise, sensor changes, injection sites, notes and day tags. Used to show your diary next to your readings and to answer your questions. Kept until you delete your account; an entry you remove can be restored for 24 hours and is deleted 30 days after you removed it.
• Apple Health data: if you connect it, your steps and workouts, and your sleep and active energy if you allow them. This data is sent to our server and stored there, and it is used in Ask's answers (see OpenAI below). Kept until you delete your account; turning Sleep or Active energy off in Slaloma deletes that data from our server (Apple Health keeps its own copy).
• Questions and answers: what you ask in Ask, typed or dictated, and its answers. Used to answer you and keep your conversation history (your chats). Kept until you delete the chat or your account. Things you asked an earlier version of Slaloma to remember are no longer kept: they were deleted with the update that removed that feature.
• Voice: your recordings when you dictate, and, if you turn on Read answers aloud, the answers to be spoken. Used to turn speech into text and answers into speech. We don't keep recordings: a dictation clip is deleted right after it has been turned into text, and spoken answers are not stored. OpenAI may keep a copy up to 30 days (see section 4).
• Lab reports: if you turn it on, the photo of a lab report that you cropped and blacked out, and the values read from it. The image is deleted when you finish, or after 24 hours at the latest. The values you save are kept until you delete them or your account; removed results are deleted after 30 days.
• Alerts and settings: the alerts we sent and your replies to them, your alert and display settings, and lows you marked as not real. Urgent low alerts are on from the start and stay on when you turn the other alerts off; the other alerts are off until you turn them on. Kept until you delete your account (internal alert calculations: 30 days).
• Push tokens: the device and Live Activity tokens Apple gives your iPhone, used to deliver alerts and Live Activity updates. Kept until the token stops working, you sign out, or you delete your account.
• Feedback: what you send under "Feedback and ideas". If you include what screen you were on and the app version, we also record your device model (from your app's request), the app version, and the tab and view you were on. It is read by us to improve Slaloma. Kept until you delete your account.
• Usage counters: daily counts of your use of Ask (for the free daily limits). Kept 400 days, or until you delete your account.
• Service logs: technical log lines (request path, status, timing, error type, an internal account number). Our code is written not to log glucose values, message text, emails or passwords. Used to run, secure and fix the service. Kept 30 days.
• IP addresses: your device's IP address is used in our server's memory for rate limits and sign-up limits against abuse, and is never stored by our service. Cloudflare, as our network provider, also sees it (section 4).
• Diagnostics and traces: records of how Ask produced an answer (the text sent to and received from the AI model, tool use, timing, safety-check results). Names, emails, CGM usernames and long numbers are masked, images and audio are dropped, and your account is identified only by a keyed hash. Used to find and fix errors and to check Ask's safety. Kept 30 days, and deleted when you delete your account.

3. Legal basis

• Health data (CGM readings, what you log, Apple Health data, lab results, health-related questions, answers and voice): your explicit consent, which you give in the app before any health data is collected. You can withdraw it at any time by deleting your account; this does not affect processing before it.
• Urgent low alerts: part of the service you agree to in the app; signing out stops them.
• Optional features (Apple Health, lab report reading, the other alerts, reading answers aloud): your consent, given when you turn each one on; you can turn each off at any time.
• Account, sign-in, push tokens, settings and usage counters: to provide the service you asked for.
• Service logs, security, abuse prevention, diagnostics and traces: our legitimate interest in running a safe and working service.

4. Who processes your data for us

We use the service providers below. Each processes data only to provide its part of the service.

• Google Cloud (hosting): Cloud Run (the app server), Cloud SQL for PostgreSQL (the database and its backups), Cloud Storage (lab report images), Cloud Logging (service logs) and Secret Manager (encryption keys and service credentials). It holds everything the service stores. Location: the EU, europe-west1 (Belgium); new resources are restricted to EU locations by policy. Google keeps its own audit logs of administrative actions in its global location.
• Self-hosted trace store (Arize Phoenix, open source, run by us inside our own Google Cloud project in europe-west1 and reachable only by us): the diagnostics and traces described above. Arize does not receive any data.
• Cloudflare (DNS, HTTPS and a secure tunnel for slaloma.app, rate limiting and bot protection): all traffic between the app and our server passes through Cloudflare's global network, including its content.
• OpenAI (a US company), only when you use these: the AI model for Ask's answers, voice (dictation, and answers read aloud if you turn that on), and reading lab report images. It receives your question and the readings, logs, lab results and Apple Health data needed to answer (your name and email are taken out; anything else you type goes as written), your dictation recordings (a voice isn't anonymous), the answers it reads aloud, and the lab image you cropped. OpenAI does not train on this data and may keep a copy up to 30 days to check for misuse (longer only if the law requires it or to prevent harm), then deletes it. Location: United States. Readings and alerts work without OpenAI.
• Resend (a US company): sends sign-in emails. It receives your email address and the sign-in link and code. Slaloma's mail is sent from Resend's EU (Ireland) sending region.
• Apple (Apple Push Notification service): delivers alerts and Live Activity updates to your iPhone. It receives the alert and Live Activity content, which includes your glucose values and trend (for example the current reading and a short recent line for the lock screen), and your device token. Encrypted in transit.

Other parties you connect us to (not our processors; their own terms and privacy policies apply):

• Your CGM data source: Abbott (LibreLinkUp) or Dexcom (Dexcom Share), or, for an account set up that way, your own Nightscout site, sees Slaloma sign in as you (or as your follower account) and read your readings.
• Google or Apple sees you sign in with them. If you signed in with Apple, we revoke our access to your Apple Account when you delete your account.

We do not send your data to any other AI provider. Earlier versions of Slaloma also sent each question to TypeSafe AI (a US company) for a safety check: the question and the previous question and answer, with names and emails taken out. Nothing goes to TypeSafe any more; it did not train on what it received and has not committed to a time limit for deleting it.

5. International transfers

Our service is hosted in the European Union (Google Cloud, europe-west1, Belgium), and its backups and logs stay there. Some providers process data in the United States: OpenAI, Resend, Cloudflare and Apple (and, for earlier versions, TypeSafe AI). You can ask us about the safeguards for these transfers at hello@slaloma.app.

6. How long we keep data

• Your account and everything in it: until you delete your account.
• Account deletion: when you choose Delete account, your account is paused at once (alerts stop) and deleted 7 days later; signing in during those 7 days restores it. You can also choose Delete now. Deletion removes your sign-in methods, sessions, push tokens, encrypted CGM sign-in, all your health data, your chats, your files and your traces.
• Database backups: daily backups and point-in-time recovery are kept 7 days, so a deleted account is gone from backups 7 days after deletion.
• A record that an account existed and was deleted: an internal account number, the event and its date, with no personal content; it has no set end date today.
• Minute-by-minute readings: 3 days once the 5-minute history covers them (low readings are kept).
• Log entries and lab results you removed: a removed log entry can be restored for 24 hours; removed entries and lab results are deleted after 30 days.
• Lab report images: deleted when you finish, or after 24 hours (a storage rule removes anything left after 2 days).
• Voice recordings: not kept by us; deleted right after they are turned into text.
• Internal alert calculations: 30 days. CGM connection checks: 7 days. Daily usage counts: 400 days.
• Sessions and sign-in links: until they expire (sign-in links: 1 day after expiry).
• Service logs: 30 days. Diagnostics and traces: 30 days, or until you delete your account if sooner.
• At OpenAI: up to 30 days (longer only if the law requires it or to prevent harm). At TypeSafe AI (earlier versions only): no committed period.

What OpenAI and TypeSafe already received cannot be recalled by deleting your account.

7. Security

• CGM sign-ins and other secrets are encrypted with their own 256-bit key using AES-256-GCM, and that key is itself encrypted with a key held in Google Secret Manager, never in the database or its backups. Each encrypted sign-in is bound to its account, so it can't be opened under another one.
• In transit: all traffic to slaloma.app uses HTTPS; the database accepts encrypted connections only, and only through Google's authenticated connector.
• At rest: Google Cloud encrypts stored data, including the database, backups and files.
• Separation between accounts: the database enforces row-level security, so each request can read and write only the signed-in person's rows.
• Least access: each service credential can be read only by the part of the service that needs it; lab image storage has no public access; the trace store is reachable only by us.
• Minimisation: names, emails and CGM usernames are masked before text goes to an AI model, and in logs and traces.
• Who can see your data: no one looks at your data except the developer, when checking Ask's traces (with names and emails masked) to fix errors and keep it safe. Whoever runs the service could technically reach the rest, including your CGM password, but would only do so to fix something, and you'd be told. Feedback you send is read. We never sell your data or share it for advertising.

No system is perfectly secure. If a breach affects your data we will tell you and the supervisory authority as the law requires.

8. Your rights

Depending on where you live (in the EU and UK under the GDPR), you have the right to:

• Access your data and get a copy: in the app, You → Privacy & data → Export everything gives you your readings, logs (including Apple Health data), alerts, lab results and your chats in Ask (each question and its answer) as CSV or JSON. For anything the export doesn't include (for example your settings or account records), write to hello@slaloma.app.
• Portability: the export is in common machine-readable formats.
• Deletion: in the app, You → Account → Delete account (see section 6).
• Correction: edit or remove log entries, lab results and settings in the app, delete a chat in Ask, or write to us.
• Withdraw consent at any time: turn the feature off, or delete your account.
• Object to processing based on our legitimate interests, and restrict processing.
• Complain to a data protection supervisory authority, in particular where you live or work.

We answer requests within one month.

After deleting your account: change your Dexcom password, or remove the Slaloma follower in your Libre app. For an account set up with a Nightscout site, delete Slaloma's token there (or change its API secret); an uploader app's secret stops working at once, so remove it from the app.

9. No ads, no tracking, no analytics

• Slaloma shows no advertising and does not use your data for advertising or marketing.
• The app contains no third-party analytics, advertising, attribution or crash-reporting code, and no third-party libraries.
• We do not track you across other companies' apps or websites, and we do not sell or share your data for that.
• Our trace store's own usage reporting is switched off.
• Slaloma does not store your health data in iCloud and does not use iCloud or CloudKit. The app keeps some recent data on your iPhone for display and offline logging.

10. Apple Health (HealthKit)

• Slaloma reads from Apple Health only what you allow: steps and workouts, and sleep and active energy if you allow them. It never writes to Apple Health.
• Health data is used only to provide Slaloma's health features to you: showing activity and sleep next to your glucose, and answering your questions. To answer, the relevant Health data is sent to OpenAI as our processor (section 4).
• We never use Health data, or share it with anyone, for advertising, marketing or data mining, and we never sell it.
• We do not store Health data in iCloud.
• You can stop access at any time in iOS Settings → Health → Data Access & Devices → Slaloma, or turn the data types off in Slaloma (which deletes sleep or active energy from our server).

11. Not a medical device; not affiliated

• Slaloma is not a medical device and is not approved by any health authority.
• Slaloma never suggests insulin doses or treatment. Its answers can be wrong; check what matters in your CGM app and talk to your diabetes care team.
• Urgent low alerts are on from the start and stay on when you turn the other alerts off (signing out stops them); the other alerts are off until you turn them on. All of them need notifications allowed for Slaloma.
• Readings and alerts can be late, missing or wrong, for example when our server is down, your CGM's sharing stops, or your phone is silenced or in a Focus that doesn't allow Slaloma. Keep your CGM app's own alarms on, always.
• Slaloma is independent: it isn't made by or affiliated with Abbott, Dexcom or Nightscout. FreeStyle Libre, LibreLinkUp and LibreView are trademarks of Abbott, and Dexcom of Dexcom, Inc.

12. Minimum age

Slaloma is for adults (18 and over); its App Store age rating is 18+. If you believe someone under 18 is using Slaloma, write to hello@slaloma.app and we will delete the account.

13. Changes to this policy

We may change this policy as Slaloma changes; the date above shows the last change. When a change affects how we use your data, the app asks you to agree again before you continue, and tells you what changed. Earlier versions are available on request.

14. Contact

Write to hello@slaloma.app with any question or request about your data.